Privacy Policy

Postvia is a web-based social media management tool that lets you compose posts, connect social accounts, schedule content, and publish to the platforms you authorize. This Privacy Policy applies to all users of Postvia and covers all data we collect, process, and store in connection with the service.

If you have questions about this policy, you can reach us through the project’s GitHub repository (github.com/ponslookspain/postvia).

A. Account information

When you sign up, we collect your name, email address, and a hashed version of your password. We also store session authentication data, including your session token, its expiry time, and (depending on your browser) your IP address and user-agent information. You can change your name and notification preferences at any time in Settings.

B. Connected social account information

When you connect a social platform (Instagram, TikTok, Threads, or X) through its official OAuth flow, we store the following to maintain the integration and perform actions you request:

• Platform name, your platform account ID, and your public username or handle
• OAuth authorization information, including access tokens and (where applicable) refresh tokens and their expiration dates

OAuth credentials are stored server-side and are never displayed in the app. They are processed and retained as necessary to maintain connected social integrations and to publish content on your behalf when you request it.

C. User content

We store the content you create and submit through Postvia, including:

• Post text and captions
• Draft posts
• Images and videos you upload
• Scheduling information (date, time, and timezone selections)
• Publication status and the identifier returned by a platform after a successful publish

D. Technical and security information

We collect IP address, browser and device information as part of session authentication records. This information is used for security, abuse prevention, and session management.

Cookies and session technologies

Postvia uses session cookies strictly for authentication purposes so the app can recognize you after you sign in. We do not use advertising, marketing, or third-party tracking cookies.

We use the information described above to:

• Authenticate you and manage your session
• Provide and operate the Postvia service
• Connect, maintain, and manage your social account integrations
• Publish content on your behalf when you request it, and show your publication history and status
• Process, validate, optimize, compress, resize, convert, store, retrieve, and deliver user-provided content as reasonably necessary to provide and improve the Service (for example, validating file types and sizes, preparing media for your selected platforms, and delivering content to publishing APIs)
• Maintain security, prevent abuse, troubleshoot, and diagnose errors
• Communicate service-related and product-update communications where you have opted in
• Comply with applicable legal obligations

We do not profile you for advertising. We do not sell, rent, or trade your personal data.

Where the General Data Protection Regulation (GDPR) or equivalent European data-protection law applies, we process personal data on the following legal bases:

• Contract: authentication, providing the service, connecting social accounts, publishing your content, scheduling, and delivering the features you use
• Legitimate interests: maintaining security, preventing abuse and fraud, improving the service, and supporting customer requests
• Consent: where required by law (for example, marketing or product-update communications)
• Legal obligations: compliance with applicable laws, regulations, and legal processes

Postvia integrates with third-party social platforms through their official APIs. By connecting a social account, you voluntarily provide Postvia with the account information and authorization credentials necessary to operate the integration. Each platform processes data independently under its own terms and privacy policies. Postvia does not control third-party platform availability, policies, or behavior.

Instagram (Meta)

Postvia integrates with Instagram through Instagram Login (OAuth) and the Instagram Content Publishing API. When you connect an Instagram Business or Creator account, we process your Instagram account ID, username, and OAuth authorization credentials to publish photos and video Reels on your behalf and to manage the integration. The permissions requested are instagram_business_basic and instagram_business_content_publish. Once published, your content is governed by Meta’s terms and privacy policy. You can disconnect your Instagram account at any time from the Postvia Accounts page, or revoke Postvia’s access directly from your Instagram or Meta account settings.

TikTok

Postvia integrates with TikTok through TikTok Login Kit and the TikTok Content Posting API. When you connect a TikTok account, we process your TikTok account ID, username, and OAuth credentials to publish authorized videos on your behalf and to manage the integration. Once published, your content is governed by TikTok’s terms and privacy policy. You can disconnect your TikTok account at any time from the Postvia Accounts page, or revoke Postvia’s access directly from your TikTok account settings.

Threads

Postvia integrates with Threads through OAuth. When you connect a Threads account, we process your Threads account ID, username, and OAuth credentials to publish text, image, and video posts on your behalf and to manage the integration. Once published, your content is governed by Threads/Meta’s terms and privacy policy. You can disconnect your Threads account at any time from the Postvia Accounts page, or revoke Postvia’s access directly from your Threads or Meta account settings.

X (Twitter)

Postvia integrates with X through OAuth. When you connect an X account, we process your X account ID, username, and OAuth credentials to publish text posts on your behalf and to manage the integration. The current X API integration may be subject to availability and credit limitations. Once published, your content is governed by X Corp.’s terms and privacy policy. You can disconnect your X account at any time from the Postvia Accounts page, or revoke Postvia’s access directly from your X account settings.

Postvia uses the following service providers to operate and deliver the service. Each provider processes data only to the extent necessary to provide its respective service, under its own terms and our agreements with them:

• Vercel — web hosting, serverless functions, background jobs, and scheduled publishing infrastructure
• Vercel Blob — private object and media storage for your uploaded images and videos
• Neon (PostgreSQL) — database storing account, session, post, media, and social-account records

Authentication is handled through an open-source library (Better Auth) on our own infrastructure; no separate third-party authentication vendor processes your authentication data. Social platform APIs (Instagram/Meta, TikTok, Threads, X) act as independent data controllers for data you publish or that they process under their own terms.

• Your data is retained for as long as needed to provide the service to you.
• Some data may be retained for a limited period as reasonably necessary to comply with legal obligations, resolve disputes, and enforce our rights.
• Connected social account data (account identifiers and OAuth credentials) is retained until you disconnect the integration or delete your account.
• User content and post data is retained while your account exists and in accordance with the service’s operational needs.
• We do not impose specific data-retention periods on user content beyond what is necessary to operate and provide the service.

You can delete your Postvia account at any time from Settings → Delete account. Account deletion permanently removes:

• Your Postvia account and user record
• Sessions and authentication data
• Posts, drafts, and post-related data
• Uploaded media files from our storage
• Stored social account credentials and OAuth tokens

Where supported, Postvia will attempt to revoke your social platform OAuth tokens during account deletion. You can also revoke Postvia’s access directly on each connected platform at any time.

Important: Account deletion only removes data under Postvia’s control. Content you have already published to Instagram, TikTok, Threads, X, or other platforms remains on those platforms and is governed by their respective terms and privacy policies. You are responsible for removing any published content on third-party platforms that you no longer want published.

You can also disconnect individual social accounts from the Accounts page and delete individual posts and their media at any time.

You can disconnect any connected social account at any time from the Postvia Accounts page. Disconnecting an account removes its stored OAuth credentials from Postvia and prevents future publishing to that platform through Postvia. Disconnecting an account does not delete content that has already been published to the platform.

Where applicable law provides them (including GDPR/EEA), you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Request erasure of your data
• Restrict the processing of your data
• Object to processing based on legitimate interests
• Receive your data in a portable format
• Withdraw consent where consent is the legal basis for processing
• Lodge a complaint with a supervisory authority in your jurisdiction

The fastest way to exercise most of these rights is to delete your account directly in Settings. You can also contact us through our GitHub repository (github.com/ponslookspain/postvia) to request access, rectification, or assistance with data subject rights. These rights are not absolute; applicable law may permit or require us to retain certain data.

Postvia’s infrastructure may process and store data in regions outside your country. For example, application hosting infrastructure is located in the United States and the database is located in the European Union. Where required by applicable law, transfers rely on the standard contractual terms and safeguards provided by our infrastructure providers. Social platform integrations may also involve transferring your published content and associated data to the platforms’ own infrastructure in different regions.

We use reasonable technical and organizational measures to protect your data, including:

• HTTPS encryption for data in transit
• Passwords stored only as cryptographic hashes
• Private media storage with short-lived, authenticated access links
• Social authentication tokens stored server-side and never exposed to the client
• Minimal data collection: we collect only what is necessary for the features you use

No method of transmission or storage is perfectly secure. We cannot guarantee absolute security.

Postvia is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you are under the age of 16, do not use Postvia. If you become aware that a child has provided us with personal data, please contact us through our GitHub repository and we will take steps to delete it.

If this policy changes, the “Effective date” above is updated. Material changes will be pointed out in the app where practical. We encourage you to review this policy periodically.

Privacy questions and data subject requests: github.com/ponslookspain/postvia (open an issue or reach the maintainer through the repository).